Loading vulnerability…
Kernel lockdown bypass in Linux Xen privcmd
CVE-2026-31788, tracked as Xen Security Advisory XSA-482, is an authorization restriction flaw in the Linux kernel's Xen privcmd driver. The driver permits user-space processes, normally restricted to root, to issue arbitrary hypercalls. In an unprivileged Xen guest booted with secure boot, a guest administrator can abuse this interface to bypass kernel lockdown, including by modifying page tables to allow user-mode modification of kernel memory. Linux PV, PVH, and HVM guests using secure boot are affected. The fix restricts privcmd operations outside dom0 to a designated target domain obtained from Xenstore.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A root process inside an affected Xen guest can modify guest kernel memory despite secure-boot-related kernel lockdown restrictions. This undermines the integrity protections that are intended to remain effective even against a guest administrator. The documented impact concerns the guest kernel; hypervisor compromise or compromise of unrelated guests is not established.
If you can’t patch tonight, do this now.
No known mitigation is identified by Xen XSA-482. Apply the guest-kernel patches or a fixed distribution kernel.
Patch, then assume compromise.
Apply the Linux guest-kernel patches for XSA-482 or install a distribution kernel update containing them, then reboot into the fixed kernel. The patches obtain the permitted target domain from Xenstore and enforce that restriction from the outset outside dom0, waiting during open() when the target domain is not yet known. Fixed SUSE kernel-default versions include 6.4.0-41.1 for Linux Micro 6.0/6.1, 6.4.0-150600.23.95.1 for applicable SLE 15 SP6 products, 6.4.0-150700.53.37.1 for applicable SLE 15 SP7 products, and 6.12.0-160000.28.1 for applicable SLE 16.0, Linux Micro 6.2, and openSUSE Leap 16.0 products. For the identified Google COS kernel package branches, update to 19738.0.0 or later for the 6.12 branch, or 18867.381.132 or later for the 6.6 branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.